Currently CIFuzz is the only action I use on a regular basis that can't be pinned to specific versions and that makes scorecard very unhappy:
"details": [
"Warn: no lock files detected for a package manager",
"Warn: dependency not pinned by hash (job 'fuzzing'): .github/workflows/cifuzz.yml:37",
"Warn: dependency not pinned by hash (job 'fuzzing'): .github/workflows/cifuzz.yml:44",
"Info: GitHub-owned actions are pinned",
It would be great if was possible to jump from one version to another automatically with Dependabot to make it easier to prevent CI from accidentally pulling breaking changes.
Currently CIFuzz is the only action I use on a regular basis that can't be pinned to specific versions and that makes
scorecardvery unhappy:It would be great if was possible to jump from one version to another automatically with Dependabot to make it easier to prevent CI from accidentally pulling breaking changes.